为什么流量在不同的 veth 设备之间路由?

为什么流量在不同的 veth 设备之间路由?

我遇到一个问题:虚拟网络设备之间存在意外的路由路径。

让我们创建两个独立的 veth-peer 设备对:

$ sudo ip link add veth0 type veth peer name peer0
$ sudo ip link add veth1 type veth peer name peer1

为 peerX 设备分配地址:

$ sudo ip addr add ab:: dev peer0
$ sudo ip addr add cd:: dev peer1

设置所有设备:

$ sudo ip link set dev veth0 up
$ sudo ip link set dev veth1 up
$ sudo ip link set dev peer1 up
$ sudo ip link set dev peer0 up

检查设备:

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 02:82:b2:df:b0:58 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic enp0s3
       valid_lft 84429sec preferred_lft 84429sec
    inet6 fe80::82:b2ff:fedf:b058/64 scope link
       valid_lft forever preferred_lft forever
3: peer0@veth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 6e:8d:c0:7c:02:9c brd ff:ff:ff:ff:ff:ff
    inet6 ab::/128 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::6c8d:c0ff:fe7c:29c/64 scope link
       valid_lft forever preferred_lft forever
4: veth0@peer0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 4e:43:26:75:10:11 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::4c43:26ff:fe75:1011/64 scope link
       valid_lft forever preferred_lft forever
5: peer1@veth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether ea:8c:82:e6:2e:a9 brd ff:ff:ff:ff:ff:ff
    inet6 cd::/128 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::e88c:82ff:fee6:2ea9/64 scope link
       valid_lft forever preferred_lft forever
6: veth1@peer1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether da:5a:68:b1:e8:43 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::d85a:68ff:feb1:e843/64 scope link
       valid_lft forever preferred_lft forever

和路线:

$ ip r
default via 10.0.2.2 dev enp0s3 proto dhcp src 10.0.2.15 metric 100
10.0.2.0/24 dev enp0s3 proto kernel scope link src 10.0.2.15
10.0.2.2 dev enp0s3 proto dhcp scope link src 10.0.2.15 metric 100

现在在 UDP 端口 2000 上监听 peer0:

$ nc -u -6 -l ab:: 2000

并通过 peer1 发送数据包:

$ echo -n abc nc -u -6 -s cd:: ab:: 2000

并听nc打印abc!但为什么?peer0peer1没有任何关联。如果我理解正确的话,监听nc应该绑定到peer0,发送nc应该绑定到peer1

答案1

peer0 和 peer1 没有以任何方式连接。

它们都是属于系统的接口,因此它们与系统相连。路由发生在系统上。系统将直接在属于自己的地址之间进行通信,而不会将数据包路由到外部,即不通过 veth 接口发送数据包,而是使用其 loopback 接口(dev lo如下所示):

# ip route get from cd:: to ab::
local ab:: from cd:: dev lo table local proto kernel src ab:: metric 0 pref medium

另外,这里没有太大帮助,但是在显示没有任何 IPv6 值来提示 IPv6 的路由时,-6必须给出,否则它默认为 IPv4。

# ip -6 route
ab:: dev peer0 proto kernel metric 256 pref medium
cd:: dev peer1 proto kernel metric 256 pref medium
fe80::/64 dev peer1 proto kernel metric 256 pref medium
fe80::/64 dev veth1 proto kernel metric 256 pref medium
fe80::/64 dev peer0 proto kernel metric 256 pref medium
fe80::/64 dev veth0 proto kernel metric 256 pref medium
# ip -6 route show table local
local ::1 dev lo proto kernel metric 0 pref medium
local fe80::4c43:26ff:fe75:1011 dev veth0 proto kernel metric 0 pref medium
local fe80::6c8d:c0ff:fe7c:29c dev peer0 proto kernel metric 0 pref medium
local fe80::d85a:68ff:feb1:e843 dev veth1 proto kernel metric 0 pref medium
local fe80::e88c:82ff:fee6:2ea9 dev peer1 proto kernel metric 0 pref medium
multicast ff00::/8 dev veth1 proto kernel metric 256 pref medium
multicast ff00::/8 dev peer1 proto kernel metric 256 pref medium
multicast ff00::/8 dev veth0 proto kernel metric 256 pref medium
multicast ff00::/8 dev peer0 proto kernel metric 256 pref medium

相关内容